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^ User accesses the authenticating entity via a two-way telephony 
communication channel 
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Authenticating entity inserts a session identifier into the two-way 
telephony communication channel that is infeasible to detect or 
eliminate without knowledge of a secret known only to the 
authenticating entity 
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Authentication information for the user is received by the authenticating 
entity via the two-way telephony communication channel 
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The authentication information is analyzed by the authenticating entity 
to determine whether the session identifier inserted by the authenticating 
authority into the two-way telephony communication channel is 
associated with the received authentication information 
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If the identifier is found to be associated with the authentication 
information, the user is authenticated by the authenticating entity based 
on the authentication information 
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User accesses the authenticating entity via a two-way telephony 
communication channel on a subsequent occasion 



\ Authenticating entity inserts a session identifier into the two-way 
telephony communication channel that is different from the session 
identifier inserted into the two-way communication channel by the 
authenticating entity during any previous session 
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Authentication information for the user is received by the authenticating 
entity via the two-way telephony communication channel 



The authentication information is analyzed by the authenticating entity 
to determine whether the session identifier inserted by the authenticating 
entity into the two-way telephony communication channel is associated 
with the received authentication information 
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If the particular session identifier is found to be associated with the 
authentication information, the user is authenticated by the 
authenticating entity based on the authentication information 

or 



\^ If not, the authentication information is analyzed further to determine 
which, if any, session identifier inserted by the authenticating entity on a 
previous occasion is associated with the received authentication 
information 
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